Arbitrary File Overwrite Vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter

CVE-2025-66262

What is CVE-2025-66262?

A vulnerability exists in the DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter that allows an attacker to overwrite arbitrary files on the system via a crafted tar archive. The vulnerable restore_mozzi_memories.sh script extracts user-controlled tar archives using the -C / flag, which permits the contents to be placed directly into the filesystem's root without proper path validation. This misconfiguration, particularly when combined with other unauthenticated file upload weaknesses, enables malicious actors to create .tgz files with path-traversed filenames that may overwrite critical system files in writable directories, leading to potential full system compromise.

References